View Issue Details

IDProjectCategoryView StatusLast Update
0010746ScribusReleasespublic2021-11-09 21:39
Reporterswilde Assigned Tomalex  
PrioritynormalSeveritymajorReproducibilityalways
Status closedResolutionunable to reproduce 
PlatformAll Debian and Ubuntu Versions 
Summary0010746: Scribus Debian Archive Signing Key can not be verified
DescriptionThe Key used to sign the apt-repository on debian.scribus.net (EEF818CF) can not be verified. The key is signed by three persons:
sig 719A575E 2007-03-12 Dale Wilcox (Work Key) <Dale@BUZZCommunications.biz>
sig 8EC3CA88 2008-07-30 Léo Studer <leo.studer@gmail.com>
sig AA23C71C 2009-03-28 Jakub Žá?ek <dawon.cz@gmail.com>

But all three of these keys are only self signed or signed by worthless keys (like PGP Global Directory Verification Key or 8108B88E, which is not available on public key servers). So it is not possible to have a OpenPGP trust path to the signing key.

An alternative would be to have a trusted source for the fingerprint of the signing key, but the full fingerprint is not published on
http://wiki.scribus.net/canvas/Debian nor any other place I found, let alone on a https accessible site with a certificate from a trusted CA...
TagsNo tags attached.
Patch

Activities

Kunda

2015-05-25 04:29

updater   ~0035230

Followup needed

Issue History

Date Modified Username Field Change
2012-06-11 11:31 swilde New Issue
2012-06-11 13:22 ale Assigned To => malex
2012-06-11 13:22 ale Status new => assigned
2015-05-25 04:29 Kunda Note Added: 0035230
2021-10-29 22:13 cbradney Status assigned => resolved
2021-10-29 22:13 cbradney Resolution open => unable to reproduce
2021-11-09 21:39 cbradney Status resolved => closed